Identifying Devices of the Internet of Things Using Machine Learning on Clock Characteristics

The number of devices of the so-called Internet of Things (IoT) is heavily increasing. One of the main challenges for operators of large networks is to autonomously and automatically identify any IoT device within the network for the sake of computer security and, subsequently, being able to better protect and secure those. In this paper, we propose a novel approach to identify IoT devices based on the unchangeable IoT hardware setup through device specific clock behavior. One feature we use is the unavoidable fact that clocks experience "clock skew" , which results in running faster or slower than an exact clock. Clock skew along with twelve other clock related features are suitable for our approach, because we can measure these features remotely through TCP timestamps which many devices can add to their packets. We show that we are able to distinguish device models by Machine Learning only using these clock characteristics. We ensure that measurements of our approach do not stress a device or causes fault states at any time. We evaluated our approach in a large-scale real-world installation at the European Organization for Nuclear Research (CERN) and show that the above-mentioned methods let us identify IoT device models within the network.